133 lines
2.9 KiB
C++
133 lines
2.9 KiB
C++
#pragma once
|
|
|
|
#include <Windows.h>
|
|
#include <winternl.h>
|
|
|
|
namespace Nt {
|
|
typedef NTSTATUS(NTAPI* OpenProcess)(
|
|
PHANDLE ProcessHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
CLIENT_ID *ClientId
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI* DuplicateObject)(
|
|
HANDLE SourceProcessHandle,
|
|
HANDLE SourceHandle,
|
|
HANDLE TargetProcessHandle,
|
|
PHANDLE TargetHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
ULONG HandleAttributes,
|
|
ULONG Options
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI *Close)(
|
|
HANDLE Handle
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI *QuerySystemInformation)(
|
|
SYSTEM_INFORMATION_CLASS,
|
|
PVOID,
|
|
ULONG,
|
|
PULONG
|
|
);
|
|
|
|
typedef NTSTATUS(NTAPI *QueryInformationProcess)(
|
|
HANDLE,
|
|
PROCESSINFOCLASS,
|
|
PVOID,
|
|
ULONG,
|
|
PULONG
|
|
);
|
|
|
|
struct PROCESS_BASIC_INFORMATION {
|
|
NTSTATUS ExitStatus;
|
|
PPEB PebBaseAddress;
|
|
ULONG_PTR AffinityMask;
|
|
LONG BasePriority;
|
|
ULONG_PTR UniqueProcessId;
|
|
ULONG_PTR InheritedFromUniqueProcessId;
|
|
};
|
|
|
|
typedef NTSTATUS(NTAPI *ReadVirtualMemory)(
|
|
HANDLE,
|
|
PVOID,
|
|
PVOID,
|
|
SIZE_T,
|
|
PSIZE_T
|
|
);
|
|
|
|
typedef struct _PEB_PARTIAL
|
|
{
|
|
BYTE Reserved1[4];
|
|
PVOID Mutant;
|
|
PVOID ImageBaseAddress;
|
|
} PEB_PARTIAL;
|
|
|
|
typedef struct _SYSTEM_THREAD_INFORMATION
|
|
{
|
|
LARGE_INTEGER KernelTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER CreateTime;
|
|
ULONG WaitTime;
|
|
PVOID StartAddress;
|
|
CLIENT_ID ClientId;
|
|
LONG Priority;
|
|
LONG BasePriority;
|
|
ULONG ContextSwitches;
|
|
ULONG ThreadState;
|
|
ULONG WaitReason;
|
|
} SYSTEM_THREAD_INFORMATION;
|
|
|
|
|
|
typedef struct _SYSTEM_PROCESS_INFORMATION
|
|
{
|
|
ULONG NextEntryOffset;
|
|
ULONG NumberOfThreads;
|
|
|
|
BYTE Reserved1[48];
|
|
|
|
UNICODE_STRING ImageName;
|
|
|
|
KPRIORITY BasePriority;
|
|
|
|
HANDLE UniqueProcessId;
|
|
HANDLE InheritedFromUniqueProcessId;
|
|
|
|
ULONG HandleCount;
|
|
ULONG SessionId;
|
|
|
|
SIZE_T UniqueProcessKey;
|
|
|
|
SIZE_T PeakVirtualSize;
|
|
SIZE_T VirtualSize;
|
|
|
|
ULONG PageFaultCount;
|
|
|
|
SIZE_T PeakWorkingSetSize;
|
|
SIZE_T WorkingSetSize;
|
|
|
|
SIZE_T QuotaPeakPagedPoolUsage;
|
|
SIZE_T QuotaPagedPoolUsage;
|
|
|
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
|
SIZE_T QuotaNonPagedPoolUsage;
|
|
|
|
SIZE_T PagefileUsage;
|
|
SIZE_T PeakPagefileUsage;
|
|
|
|
SIZE_T PrivatePageCount;
|
|
|
|
LARGE_INTEGER ReadOperationCount;
|
|
LARGE_INTEGER WriteOperationCount;
|
|
LARGE_INTEGER OtherOperationCount;
|
|
|
|
LARGE_INTEGER ReadTransferCount;
|
|
LARGE_INTEGER WriteTransferCount;
|
|
LARGE_INTEGER OtherTransferCount;
|
|
|
|
SYSTEM_THREAD_INFORMATION Threads[1];
|
|
|
|
} SYSTEM_PROCESS_INFORMATION;
|
|
}
|